M5d: account-bound quote revisions and interactive readback

[owieschon]

What changed

• lock D16 before code: a revision requires the quote account to match the caller's current verified account before any store mutation
• add SQLite revision sequencing and active/superseded status with a guarded migration
• reopen immutable quote lines into the existing Order edit machinery
• require a new readback and separate explicit assent before revision 2 exists
• re-read price and availability, preserve the quote number, supersede revision 1, and enqueue revision 2
• carry store-issued quote identity through provenance and every runtime speech boundary
• make readback above four lines interactive across turns, including barge-in edit/restart

Why

M5d delivery is merged, but delivered quotes were immutable endpoints. This PR
adds revisions without treating possession of a printed quote number as
authorization and without copying stale price/availability facts.

Cold review also found that the original chunking plan would have remained one
long TTS string and that the quote-number envelope stopped before runtime. The
implementation therefore uses stateful chunk turns and a response-aware speech
guard at the actual app/endpoint boundaries.

Safety proofs

• cross-account request returns exact revision_unauthorized, journals once,
  leaves latest at revision 1, and leaves SQLite total_changes unchanged
• changed synthetic price and inventory values appear in revision 2 with fresh
  timestamps; no revision/store write exists after open, edit, readback, or
  not yet
• fabricated quote identity is suppressed through the endpoint harness while
  store-issued identity is structurally surfaced
• six-line readback pauses at 4/6 and 6/6, accepts a second-line barge-in edit,
  restarts, and issues only after final confirmation

Validation

• 762 tests collected: 752 passed, 10 skipped
• ruff and mypy clean across 78 source files
• four hash-pinned external revision oracles pass
• round-trip identity 9487/9487; full round-trip 96.96%
• noise-resilience: zero inventions
• independent resolution evaluation: 14/14

Dispatch state remains honestly UNVERIFIED: the final oracle hardening landed
after the bounded two-pass cold review. This draft PR review is the remaining
human control.

Remaining scope

• live email/SMS provider adapters and credentials
• voice-spelled quote-number revision entry
• rate limiting for revision-number lookup enumeration
• production scheduling/operations for the explicit delivery worker